Cannot de-assign role through SCIM

Question

We have set up provisioning according https://learn.microsoft.com/en-us/entra/identity/app-provisioning/customize-application-attributes#provisioning-a-role-to-a-scim-app

We tried all 3 functions that were mentioned: SingleAppRoleAssignment, AppRoleAssignmentsComplex, AssertiveAppRoleAssignmentsComplex

None of them seem to de-assign roles that Azure/Entra doesn't know about

---

Assuming target User has either admin/employee roles assigned in Azure/Entra:

SCIM server responds with

  "roles": [
    {
      "value": "admin",
      "display": "Admin",
      "type": "COMPLIANCE_COCKPIT",
      "primary": true
    },
    {
      "value": "employee",
      "display": "Employee",
      "type": "INTEGRITY_HUB",
      "primary": true
    }
  ],

Given this mapping

Azure/Entra refuses to process the user:

Given other mapping, like so

Azure/Entra SCIM client attempts to always do PATCH ADD operation instead of replace/add+remove

"Operations":[{"op":"Add","path":"roles","value":[{"value":"admin"}]}

This means SCIM server doesn't know that it should drop the other role. This in effect means once user gets role assigned through application that's different than the one specified in Azure, you cannot revoke access through SCIM. Same issue is with all 3 functions, if target attribute is roles.

I found related issue at https://learn.microsoft.com/en-us/answers/questions/1163551/azure-scim-user-provision-sending-patch-with-add-o but answer there was that you simply do not support multi-value/complex custom attributes, while roles is not a custom attribute, it's a core SCIM attribute